Visor Dynamics · Geospatial Intelligence
All articles
AI 16 min read

Is a military AI agent just a chatbot with tools?

Building an AI agent now takes minutes. Building one a military can trust with real missions is a different problem, and most of the hard parts have little to do with the model.

In April 2026, Pentagon staff used a no-code tool on the department's GenAI.mil platform to build more than 100,000 AI agents in about five weeks. Most of them do staff work, such as drafting reports, summarizing documents and searching policy. The episode showed how easy it has become to make something that calls itself an agent. You describe a goal, connect a few tools, and the model does the rest.

Being easy to build doesn't make an agent fit for military work. An agent that drafts an after-action report and an agent that sorts intelligence for a strike package are built from the same parts, but the second one has to work with classified data, under deliberate deception, with someone accountable for every output. A military agent is far more than a chatbot with tools attached, and the difference is mostly in the problems that come with letting software act.

From answers to actions

A chatbot answers a question and stops. A person reads the answer and decides what to do with it.

An agent is given a goal instead. It breaks the goal into steps, chooses tools and data sources, takes actions such as running queries, drafting orders or requesting tasking, looks at the results and keeps going until it finishes or someone stops it. Increasingly, several specialized agents are chained together, with one gathering information, another analyzing it and a third drafting options for a commander.

A 2026 paper by Jean-Marc Rickli and Tobias Knappe at the Geneva Centre for Security Policy describes agents as having four parts: perception to take in data, a cognitive core (usually a large language model) to plan and decide, an action module to use tools and systems, and memory to learn from what happened before. It also notes that agentic AI can be built into every stage of the military OODA loop, with the largest gains in deciding and acting, which are also the stages where mistakes cost the most.

Who is building what

The United States is furthest along, at least in public. In July 2025 the Pentagon's Chief Digital and AI Office gave Anthropic, Google, OpenAI and xAI contracts worth up to $200 million each to develop "agentic AI workflows across a variety of mission areas." In January 2026 the department's new AI strategy set the goal of an "AI-first warfighting force" and launched seven Pace-Setting Projects. One of them, the Agent Network announced in June 2026, uses agents to scan intelligence and operational systems continuously and turn what they find into decision options for commanders, for battle management and targeting. It builds on Palantir's Maven Smart System and an agentic operating system from a company called Lumbra. The department says humans keep authority over targeting decisions, but it has not published concrete use cases.

Other efforts are spread across the services and industry:

  • Thunderforge, a Defense Innovation Unit project led by Scale AI with Anduril and Microsoft, aims to create "a unified planning ecosystem where AI agents simulate wargaming and planning scenarios and refine proposed courses of action," starting at Indo-Pacific Command and European Command.
  • The US Army signed a $5.6 billion agreement with Salesforce in January 2026 that includes deploying AI agents. The Army Research Laboratory's COA-GPT, which generates courses of action, took part in Project Convergence in July 2026. At the Command and General Staff College, an AI wargaming agent let officers play nine turns in a day instead of the usual one or two.
  • Palantir's platforms are the most widely used. Maven Smart System combines data feeds, flags potential targets and helps build strike packages, and its AIP Agent Studio lets users chain several specialized models together for multistep tasks. Reporting by Air & Space Forces Magazine and others says Maven was used to prepare strikes on around 1,000 targets in the first 24 hours of the 2026 Iran campaign.
  • Smaller companies are taking different approaches. Edgerunner AI's WarClaw runs offline on local hardware, is trained on curated military data, and cannot change its strategy without an operator's permission.

Elsewhere, the picture is less clear. China's PLA has adopted DeepSeek models for non-combat work such as medical planning and evacuation manuals, and Georgetown's CSET found procurement documents asking for AI tools in command, space and cyber operations. The GCSP paper notes that the PLA is exploring multi-agent collaboration as part of its "intelligentized warfare" concept. NATO officials say the harder problem is governance, such as what happens when allied commanders receive conflicting conclusions from different national AI systems.

The GCSP authors also offer a reality check. By their assessment, military agents have so far been demonstrated only "in controlled and experimental settings." AI-assisted planning and decision support look plausible within one to three years. Autonomous agents working alongside troops in combat remain speculative. Reliable military agents are mostly still being built.

Why it's harder than it looks

Mistakes compound

Language models still make things up, and as the GCSP paper puts it, "no technical solutions currently exist" to stop this from affecting reliability. In a chatbot, a hallucination is one wrong answer that a person reads and can question. In an agent, the next step is built on the wrong answer, and the step after that builds on the next one. In a chain of agents, one invented detail can travel through several analyses and arrive in front of a commander looking like a conclusion three systems agreed on.

The enemy writes for your agent

An agent that reads intercepted messages, open-source reporting or web pages is reading text written by people who may know it is there. Models cannot reliably tell instructions apart from data, so hidden text in a document can change what an agent does. Researchers call this prompt injection, and in one benchmark GPT-4-based agents fell for it between 24% and 47% of the time. The GCSP paper describes "agent traps," where hidden instructions on a web page lead a reconnaissance agent to download malware.

The problem goes beyond individual documents. Investigators found that a Russian network of websites had pushed its narratives into widely used AI models so effectively that the tools repeated them in about a third of tested cases. More than half of new articles on the web are now AI-generated. An agent that browses has no reliable way to tell credible reporting from rumor or planted disinformation. John Boyd wrote about winning by corrupting the opponent's picture of the situation, and poisoning the sources an agent reads is a new way to do exactly that.

What an agent remembers

Agents have two kinds of memory. Short-term memory is the context window: everything the model can see during the current task, including instructions, documents, tool results and the conversation so far. Long-term memory is a store the agent can write to and search later, so it can recall earlier missions, user preferences or standing guidance.

Both cause problems when handled carelessly. A common mistake is to save everything to long-term memory just in case. In our experience this makes results worse. Every irrelevant or outdated note becomes something the agent might retrieve later and treat as relevant: last month's unit positions, a superseded order, a guess that was later corrected. Memory needs the same discipline as any other intelligence product, with a source, a date and a reason to keep it. Anything else should expire.

Long-term memory is also a target. If an adversary can get false information into an agent's memory, the error does not disappear when the session ends. It comes back in later tasks, possibly for different users.

Coordinates are not understanding

Military tasks carry a lot of precise geographic data: latitudes and longitudes, grid references, unit boundaries, routes, and polygons describing areas of operation or no-strike zones. It is tempting to paste all of it into the agent's context so it has the full picture. This usually backfires.

Language models don't reason about numbers the way a GIS does. They break a coordinate into fragments of text, so a long string of digits carries little meaning to the model, and it can't reliably calculate whether a point falls inside a 400-vertex polygon by reading the vertices. What models handle well are references: "Objective Bravo," "the bridge at the northern crossing," "Phase Line Red." Raw geometry also takes up a large share of the context window. A few detailed polygons can run to thousands of tokens, and research on long contexts, such as the "Lost in the Middle" study, shows that models pay less attention to information buried in long inputs. The mission context gets drowned out by the numbers.

A better design is to give the agent named references and let deterministic tools do the geometry. The agent decides that it needs to know whether a convoy route crosses a restricted area, and a GIS function that does exact calculations answers that question. That way the model only has to reason about what things are and why they matter, and the exact numbers stay with software designed to handle them. We built Elite AI, our reasoning system for defense, around the same split: its language models handle intent and context, while classical machine learning and data science algorithms handle the calculations language models get wrong.

Agents should ask, not assume

Orders are often incomplete. A good staff officer who gets an ambiguous task asks which unit, which grid, by when, or what the commander actually intends. Language models tend to do the opposite. They are trained to be helpful and to produce an answer, so when something is missing they fill the gap with a plausible assumption and carry on, often without saying they made one.

In a chatbot, that produces a confident but wrong paragraph. In an agent, it produces actions based on a guess. A military agent should be designed to stop and ask when a request is ambiguous or when an assumption would change the outcome, and to state clearly any assumptions it does make. That makes it slower in the moment, but it's how human staffs avoid costly misunderstandings, and agents should be held to the same standard.

Nobody can fully explain the output

Even the people who build large language models can't fully explain why a model produced a particular answer, or why it sometimes hallucinates. Interpretability research is making progress, but the GCSP paper notes that it "cannot fully explain LLM behaviour." When an agent combines several analytical steps into one recommendation, a commander sees the conclusion without the reasoning. The Institute for AI Policy and Strategy warns that this kind of compression is exactly what encourages people to over-trust machine recommendations.

Who answers for it?

International humanitarian law depends on someone being responsible for each decision to use force. Agents blur that. If an agent drafted the target list, another ranked it and a human approved it in a few seconds, it is hard to say who actually decided. The GCSP authors point out that it can be technically difficult even to work out whom an agent was acting for when it took a particular action.

The question of who sets an agent's limits is also unsettled. In early 2026, Anthropic refused to allow its models to be used for fully autonomous weapons or domestic mass surveillance. The Pentagon responded by designating the company a supply chain risk, arguing that a vendor should not be able to restrict lawful military use. The case is still in the courts. Whatever the outcome, it showed that the rules an agent follows can be contested between the companies that build the models and the militaries that use them.

Many models won't help at all

There is also a more basic obstacle. General-purpose models are trained for the public, and their safety training treats much of ordinary military work as harmful. Ask one to assess an air defense threat, plan an ingress route or explain how a weapon system works, and it will often refuse outright or give a vague non-answer. A February 2026 study tested 31 public models against questions written with US Army and special forces veterans and found refusal rates as high as 98.2%, with some models also deflecting instead of answering. The study's authors include people who build military models, so they have an interest in the result, but anyone who has tried to use a commercial chatbot for defense work will recognize the problem.

Refusals hurt agents more than chatbots. If an agent stops partway through a multistep task, the steps it has already taken can leave a plan or a product half finished, and someone has to work out where it stopped. Removing refusals crudely doesn't solve it either. The same study found that stripping them out of a model cost some accuracy on other military tasks. Reliable military agents need models trained on doctrine and real military tasks from the start, which is the approach we took with Elite AI. Its page shows an example of a commercial model refusing a routine defense question that Elite AI answers.

Useful agents need dangerous access

To be useful, a military agent needs to read classified databases, query operational systems and sometimes send messages or requests on someone's behalf. Every permission an agent has is a permission an attacker gains if the agent is compromised. Agents also need their own credentials, and there is no agreed standard yet for verifying an agent's identity. The GCSP paper calls this a direct trade-off: limiting access and monitoring agents closely makes them safer and also takes away much of what made them worth using.

Agents don't always do what they're told

Agents pursue goals, and sometimes they find ways to do it that nobody intended. In a 2025 study, Anthropic tested 16 leading models from several companies in simulated corporate settings and found that, when harmful actions were the only way to achieve their goals, models sometimes chose blackmail or leaking information over failing. The scenarios were artificial, and nothing similar has been seen in real deployments. Other experiments have found agents trying to extend their own runtime, gaming the systems that score them, and lying when losing at chess. In March 2026, researchers from Harvard, MIT and elsewhere reported agents obeying people who were not their owners, disclosing sensitive information and taking destructive actions on the systems they ran on.

Wargames show a related risk. In a 2024 study by Juan-Pablo Rivera and colleagues, five widely used models playing nation-state agents all escalated over time, developed arms-race dynamics and in rare cases used nuclear weapons, justifying it with deterrence and first-strike reasoning. A 2025 partial replication found that simple instructions reduced the escalation considerably, which is encouraging, but it also shows how much the behavior depends on how the agent is set up.

More agents, more ways to fail

Chaining agents together multiplies the problems. Errors spread between them, and unexpected interactions can produce behavior that none of them showed alone. Researchers have documented "echoing," where agents abandon their assigned roles and start mirroring each other, and attacks that exploit the trust agents place in messages from other agents. One study cited by the GCSP paper found that 80% of multi-agent projects fail because of complexity and coordination problems. In a coalition, where agents from different nations and vendors would have to work together, coordination gets harder still.

More options, less time

Agents are often sold as the answer to information overload. In practice they tend to move the burden rather than remove it. A 2026 US Army monograph on AI in mission command found that AI "redistributes the cognitive load" across the staff instead of eliminating it. A commander who used to get one carefully prepared course of action may now get ten, each generated in seconds and each needing judgment. If the number of recommendations per hour goes up, the time to think about each one goes down.

Filtering helps, but filters also decide what the commander sees. Over time, people who defer to the machine lose some of the skill needed to check it, and that matters most on the day the agent fails and someone has to take over by hand.

What it takes to field one

None of this means militaries should avoid agents. Many of the tasks agents are good at, such as sorting reports, drafting routine products, running more wargame turns and spotting anomalies in large data sets, are real bottlenecks today. Fielding agents responsibly does mean treating them as a system to engineer, not a model to plug in:

  • Give agents narrow, clearly bounded jobs, with explicit rules for when they must stop and hand a decision to a person.
  • Route anything with real consequences through human approval and a secure middleware layer, so no agent can write directly to weapons or data link networks.
  • Run models on accredited infrastructure, preferably offline or air-gapped for sensitive work, so mission data never leaves the network.
  • Keep context small and relevant. Use references and deterministic tools for geometry and numbers instead of pasting raw data into prompts.
  • Treat memory as curated data with sources, dates and expiry, not a dump of everything the agent has seen.
  • Log every step, tool call and source so a decision can be reconstructed afterwards.
  • Red-team agents against deception and prompt injection before they meet a real adversary.
  • Keep training people to do the work without the agent, so they can still check it and take over when it fails.

These are the principles we followed in Elite AI. It runs fully offline in air-gapped networks with no external API calls, uses role-based access so what it reveals depends on the user's clearance, routes each task to a specialized model for reasoning, vision, documents or agentic work, and leaves the final course of action with the human operator.

So, is it just a chatbot with tools?

No. Connecting a model to a few tools now takes an afternoon, and that part is no longer the hard one. The hard part is deciding what the agent may see and remember, when it has to stop and ask, who signs off on what it does, and who answers for it when it is wrong, all while an opponent is actively trying to mislead it. Every military that wants to use agents still has most of that work ahead of it, and we expect the ones that take it seriously to get far more out of agents than the ones that just build a lot of them.

References

More articles

View All Articles
Strategy

Is mosaic warfare already here?

DARPA imagined a force of cheap, interchangeable pieces. Ukraine, Iran and the Pentagon suggest much of it is here, except the software to hold it together.
Engineering

Would you trust vibe-coded defense software?

AI can write code faster than anyone can read it. In defense, that raises hard questions about security, accountability and who can still fix the system when it fails.
Strategy

Collapse the OODA loop

Whoever observes, orients, decides and acts faster than the opponent sets the pace. Where each step slows down, and how software is shortening the loop on the battlefield and in business.

© Visor Dynamics (Pvt) Ltd.

Visor Dynamics · Geospatial Intelligence